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CLAIMS 



We Claim: 

1 A real-time virus tracking and display apparatus for use with a distributed 
computer network, the apparatus comprising: 

a plurality of client users having potentially infected client com puters^ - 

at least one anti-virus scanning server accessible via the distributed computer 
network, whereby the client users contact the server to facilitate scanning of the client 
computers; 

a scan log which is sent back from each client user detailing certain results of the 
virus scan on each client computer; 

a virus-tracking server for real-time receiving and processing the scan log 
information; 

a database server associated with the virus-tracking server for real-time receiving 
and processing of the scan log information into virus-tracking information; and 

at least one virus tracking display mode accessible by a tracking user from the 
virus tracking server, the display mode providing real-time updates of virus information 
pertaining to the scan logs. 



2. The apparatus according to Claim 1, wherein the tracking user can 
configure the display modes to show the virus-tracking information in association with 
user-selected geographic maps of where the viruses are occurring. 



3. The apparatus according to Claim 2, wherein the display modes include a 
plurality of web pages with user selectable menus to configure the virus-tracking display 
on the pages. 
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4. The apparatus according to Claim 1, wherein the scan log contains no 
information relating to the direct identification of the client user. 

5. The apparatus according to Claim 4, wherein the scan log includes the 
name of the virus, the frequency of its occurrence, and the geographic location of the 
infected computer. 

6. The apparatus according to Claim 1 , wherein a servlet program on the 
virus-tracking server is used to receive the scan log information from the at least one anti- 
virus scanning server. 

7. The apparatus according to Claim 1 , wherein a polling program is used to 
regularly retrieve vims tracking information from the database server and store it in a 
data object. 

8. The apparatus of Claim 7, wherein a common gateway interface (CGI) 
program is used to retrieve the data object for display by the tracking user. 

9. The apparatus of Claim 1 , wherein a Java applet running on tracking user 
browser is used to display a real-time virus tracing map. 

1 0. The apparatus of Claim 1 , wherein the client user is also the tracking user. 
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1 1 . The apparatus of Claim 1 , wherein the distributed computer network of 
includes the Internet. 



12. A method to provide real-time virus tracking and display for use with a 
distributed computer network, the method comprising: 

providing an anti-virus scanning program on at least one anti-virus scanning 
server accessible via the distributed computer network; 

invoking the anti-virus scanning program from a plurality of client users having 
potentially infected client computers; 

generating a scan log from each scanned computer and sending it back from each 
client user, the scan log detailing certain results of the virus scan on each client computer; 

receiving and processing the scan log information in real-time via a virus-tracking 
server associated with the distributed computer network; 

processing the scan log information into virus tracing information and storing it 
on a database server associated vAth the virus-tracking server; and 

retrieving the virus tracing information, and displaying a real-time trace on a 
tracking user device. 

13. The method according to Claim 12, which further includes configuring the 
display modes by the tracking user to show the virus-tracking information in association 
with user-selected geographic maps of where the viruses are occurring. 



14. The method according to Claim 13, which fiirther includes displaying the 
modes via a plurality of web pages with user selectable menus to configure the virus- 
tracking display on the pages. 
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15. The method according to Claim 12, wherein the scan log contains no 
information relating to the direct identification of the client user. 

16. The method according to Claim 15, wherein the scan log includes the 
name of the virus, the frequency of its occurrence, and the geographic location of the 
infected computer. 

17. The method according to Claim 12, which further includes providing a 
servlet program on the virus-tracking server to receive the scan log information from the 
at least one anti-virus scanning server. 

18. The method according to Claim 12, which further includes providing a 
polling program to regularly retrieve virus tracking information firom the database server 
and store it in a data object. 

1 9. The method of Claim 1 8, which further includes providing a common 
gateway interface (CGI) program to retrieve the data object for display by the tracking 
user. 

20. The apparatus of Claim 12, which further includes running a Java applet 
on the browser of the tracking user to display a real-time virus tracing map. 

21 . The apparatus of Claim 12, wherein the client user is also the tracking 

user. 
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22. The apparatus of Claim 12, wherein the distributed computer network of 
includes the Internet. 
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